4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
20 lines
668 B
YAML
20 lines
668 B
YAML
# Host-specific variables for CoulombCore (92.205.130.254)
|
|
# k3s single-node cluster host — HostEurope
|
|
|
|
# Do not enable or rewrite UFW on this host. Live filter is iptables INPUT
|
|
# DROP with a Plesk-era accept list (UFW status: inactive). Enabling UFW
|
|
# here would take down 80/443 and the rest of the accepted surface unless
|
|
# every live accept is declared first. RAIL-HO-WP-0009-T03.
|
|
ufw_manage: false
|
|
|
|
# Swapfile (T01)
|
|
swap_size_gb: 4
|
|
swap_swappiness: 10
|
|
|
|
# Resource limits (T02) — prevents runaway agents (see INC-002)
|
|
resource_limit_user: tegwick
|
|
resource_limit_uid: 1000
|
|
nproc_soft: 512
|
|
nproc_hard: 1024
|
|
user_memory_max: "1500M"
|
|
user_memory_swap_max: "512M"
|